# Redmine - project management software
        
      
        

          
          
          # Copyright (C) 2006-2012  Jean-Philippe Lang
        
      
        

          
          
          #
        
      
        

          
          
          # This program is free software; you can redistribute it and/or
        
      
        

          
          
          # modify it under the terms of the GNU General Public License
        
      
        

          
          
          # as published by the Free Software Foundation; either version 2
        
      
        

          
          
          # of the License, or (at your option) any later version.
        
      
        

          
          
          #
        
      
        

          
          
          # This program is distributed in the hope that it will be useful,
        
      
        

          
          
          # but WITHOUT ANY WARRANTY; without even the implied warranty of
        
      
        

          
          
          # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
        
      
        

          
          
          # GNU General Public License for more details.
        
      
        

          
          
          #
        
      
        

          
          
          # You should have received a copy of the GNU General Public License
        
      
        

          
          
          # along with this program; if not, write to the Free Software
        
      
        

          
          
          # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
        
      
        

          
          
          
        
      
        

          1
          
          class AccountController < ApplicationController
        
      
        

          1
          
            helper :custom_fields
        
      
        

          1
          
            include CustomFieldsHelper
        
      
        

          
          
          
        
      
        

          
          
            # prevents login action to be filtered by check_if_login_required application scope filter
        
      
        

          1
          
            skip_before_filter :check_if_login_required
        
      
        

          
          
          
        
      
        

          
          
            # Login request and validation
        
      
        

          1
          
            def login
        
      
        

          246
          
              if request.get?
        
      
        

          123
          
                logout_user
        
      
        

          
          
              else
        
      
        

          123
          
                authenticate_user
        
      
        

          
          
              end
        
      
        

          
          
            rescue AuthSourceException => e
        
      
        

          
          
              logger.error "An error occured when authenticating #{params[:username]}: #{e.message}"
        
      
        

          
          
              render_error :message => e.message
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Log out current user and redirect to welcome page
        
      
        

          1
          
            def logout
        
      
        

          4
          
              logout_user
        
      
        

          4
          
              redirect_to home_url
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Enable user to choose a new password
        
      
        

          1
          
            def lost_password
        
      
        

          
          
              redirect_to(home_url) && return unless Setting.lost_password?
        
      
        

          
          
              if params[:token]
        
      
        

          
          
                @token = Token.find_by_action_and_value("recovery", params[:token])
        
      
        

          
          
                redirect_to(home_url) && return unless @token and !@token.expired?
        
      
        

          
          
                @user = @token.user
        
      
        

          
          
                if request.post?
        
      
        

          
          
                  @user.password, @user.password_confirmation = params[:new_password], params[:new_password_confirmation]
        
      
        

          
          
                  if @user.save
        
      
        

          
          
                    @token.destroy
        
      
        

          
          
                    flash[:notice] = l(:notice_account_password_updated)
        
      
        

          
          
                    redirect_to :action => 'login'
        
      
        

          
          
                    return
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
                render :template => "account/password_recovery"
        
      
        

          
          
                return
        
      
        

          
          
              else
        
      
        

          
          
                if request.post?
        
      
        

          
          
                  user = User.find_by_mail(params[:mail])
        
      
        

          
          
                  # user not found in db
        
      
        

          
          
                  (flash.now[:error] = l(:notice_account_unknown_email); return) unless user
        
      
        

          
          
                  # user uses an external authentification
        
      
        

          
          
                  (flash.now[:error] = l(:notice_can_t_change_password); return) if user.auth_source_id
        
      
        

          
          
                  # create a new token for password recovery
        
      
        

          
          
                  token = Token.new(:user => user, :action => "recovery")
        
      
        

          
          
                  if token.save
        
      
        

          
          
                    Mailer.lost_password(token).deliver
        
      
        

          
          
                    flash[:notice] = l(:notice_account_lost_email_sent)
        
      
        

          
          
                    redirect_to :action => 'login'
        
      
        

          
          
                    return
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # User self-registration
        
      
        

          1
          
            def register
        
      
        

          
          
              redirect_to(home_url) && return unless Setting.self_registration? || session[:auth_source_registration]
        
      
        

          
          
              if request.get?
        
      
        

          
          
                session[:auth_source_registration] = nil
        
      
        

          
          
                @user = User.new(:language => Setting.default_language)
        
      
        

          
          
              else
        
      
        

          
          
                @user = User.new
        
      
        

          
          
                @user.safe_attributes = params[:user]
        
      
        

          
          
                @user.admin = false
        
      
        

          
          
                @user.register
        
      
        

          
          
                if session[:auth_source_registration]
        
      
        

          
          
                  @user.activate
        
      
        

          
          
                  @user.login = session[:auth_source_registration][:login]
        
      
        

          
          
                  @user.auth_source_id = session[:auth_source_registration][:auth_source_id]
        
      
        

          
          
                  if @user.save
        
      
        

          
          
                    session[:auth_source_registration] = nil
        
      
        

          
          
                    self.logged_user = @user
        
      
        

          
          
                    flash[:notice] = l(:notice_account_activated)
        
      
        

          
          
                    redirect_to :controller => 'my', :action => 'account'
        
      
        

          
          
                  end
        
      
        

          
          
                else
        
      
        

          
          
                  @user.login = params[:user][:login]
        
      
        

          
          
                  @user.password, @user.password_confirmation = params[:user][:password], params[:user][:password_confirmation]
        
      
        

          
          
          
        
      
        

          
          
                  case Setting.self_registration
        
      
        

          
          
                  when '1'
        
      
        

          
          
                    register_by_email_activation(@user)
        
      
        

          
          
                  when '3'
        
      
        

          
          
                    register_automatically(@user)
        
      
        

          
          
                  else
        
      
        

          
          
                    register_manually_by_administrator(@user)
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Token based account activation
        
      
        

          1
          
            def activate
        
      
        

          
          
              redirect_to(home_url) && return unless Setting.self_registration? && params[:token]
        
      
        

          
          
              token = Token.find_by_action_and_value('register', params[:token])
        
      
        

          
          
              redirect_to(home_url) && return unless token and !token.expired?
        
      
        

          
          
              user = token.user
        
      
        

          
          
              redirect_to(home_url) && return unless user.registered?
        
      
        

          
          
              user.activate
        
      
        

          
          
              if user.save
        
      
        

          
          
                token.destroy
        
      
        

          
          
                flash[:notice] = l(:notice_account_activated)
        
      
        

          
          
              end
        
      
        

          
          
              redirect_to :action => 'login'
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            private
        
      
        

          
          
          
        
      
        

          1
          
            def authenticate_user
        
      
        

          123
          
              if Setting.openid? && using_open_id?
        
      
        

          
          
                open_id_authenticate(params[:openid_url])
        
      
        

          
          
              else
        
      
        

          123
          
                password_authentication
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def password_authentication
        
      
        

          123
          
              user = User.try_to_login(params[:username], params[:password])
        
      
        

          
          
          
        
      
        

          123
          
              if user.nil?
        
      
        

          
          
                invalid_credentials
        
      
        

          123
          
              elsif user.new_record?
        
      
        

          
          
                onthefly_creation_failed(user, {:login => user.login, :auth_source_id => user.auth_source_id })
        
      
        

          
          
              else
        
      
        

          
          
                # Valid user
        
      
        

          123
          
                successful_authentication(user)
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def open_id_authenticate(openid_url)
        
      
        

          
          
              authenticate_with_open_id(openid_url, :required => [:nickname, :fullname, :email], :return_to => signin_url, :method => :post) do |result, identity_url, registration|
        
      
        

          
          
                if result.successful?
        
      
        

          
          
                  user = User.find_or_initialize_by_identity_url(identity_url)
        
      
        

          
          
                  if user.new_record?
        
      
        

          
          
                    # Self-registration off
        
      
        

          
          
                    redirect_to(home_url) && return unless Setting.self_registration?
        
      
        

          
          
          
        
      
        

          
          
                    # Create on the fly
        
      
        

          
          
                    user.login = registration['nickname'] unless registration['nickname'].nil?
        
      
        

          
          
                    user.mail = registration['email'] unless registration['email'].nil?
        
      
        

          
          
                    user.firstname, user.lastname = registration['fullname'].split(' ') unless registration['fullname'].nil?
        
      
        

          
          
                    user.random_password
        
      
        

          
          
                    user.register
        
      
        

          
          
          
        
      
        

          
          
                    case Setting.self_registration
        
      
        

          
          
                    when '1'
        
      
        

          
          
                      register_by_email_activation(user) do
        
      
        

          
          
                        onthefly_creation_failed(user)
        
      
        

          
          
                      end
        
      
        

          
          
                    when '3'
        
      
        

          
          
                      register_automatically(user) do
        
      
        

          
          
                        onthefly_creation_failed(user)
        
      
        

          
          
                      end
        
      
        

          
          
                    else
        
      
        

          
          
                      register_manually_by_administrator(user) do
        
      
        

          
          
                        onthefly_creation_failed(user)
        
      
        

          
          
                      end
        
      
        

          
          
                    end
        
      
        

          
          
                  else
        
      
        

          
          
                    # Existing record
        
      
        

          
          
                    if user.active?
        
      
        

          
          
                      successful_authentication(user)
        
      
        

          
          
                    else
        
      
        

          
          
                      account_pending
        
      
        

          
          
                    end
        
      
        

          
          
                  end
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def successful_authentication(user)
        
      
        

          
          
              # Valid user
        
      
        

          123
          
              self.logged_user = user
        
      
        

          
          
              # generate a key and set cookie if autologin
        
      
        

          123
          
              if params[:autologin] && Setting.autologin?
        
      
        

          
          
                set_autologin_cookie(user)
        
      
        

          
          
              end
        
      
        

          123
          
              call_hook(:controller_account_success_authentication_after, {:user => user })
        
      
        

          123
          
              redirect_back_or_default :controller => 'my', :action => 'page'
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def set_autologin_cookie(user)
        
      
        

          
          
              token = Token.create(:user => user, :action => 'autologin')
        
      
        

          
          
              cookie_name = Redmine::Configuration['autologin_cookie_name'] || 'autologin'
        
      
        

          
          
              cookie_options = {
        
      
        

          
          
                :value => token.value,
        
      
        

          
          
                :expires => 1.year.from_now,
        
      
        

          
          
                :path => (Redmine::Configuration['autologin_cookie_path'] || '/'),
        
      
        

          
          
                :secure => (Redmine::Configuration['autologin_cookie_secure'] ? true : false),
        
      
        

          
          
                :httponly => true
        
      
        

          
          
              }
        
      
        

          
          
              cookies[cookie_name] = cookie_options
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Onthefly creation failed, display the registration form to fill/fix attributes
        
      
        

          1
          
            def onthefly_creation_failed(user, auth_source_options = { })
        
      
        

          
          
              @user = user
        
      
        

          
          
              session[:auth_source_registration] = auth_source_options unless auth_source_options.empty?
        
      
        

          
          
              render :action => 'register'
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def invalid_credentials
        
      
        

          
          
              logger.warn "Failed login for '#{params[:username]}' from #{request.remote_ip} at #{Time.now.utc}"
        
      
        

          
          
              flash.now[:error] = l(:notice_account_invalid_creditentials)
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Register a user for email activation.
        
      
        

          
          
            #
        
      
        

          
          
            # Pass a block for behavior when a user fails to save
        
      
        

          1
          
            def register_by_email_activation(user, &block)
        
      
        

          
          
              token = Token.new(:user => user, :action => "register")
        
      
        

          
          
              if user.save and token.save
        
      
        

          
          
                Mailer.register(token).deliver
        
      
        

          
          
                flash[:notice] = l(:notice_account_register_done)
        
      
        

          
          
                redirect_to :action => 'login'
        
      
        

          
          
              else
        
      
        

          
          
                yield if block_given?
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Automatically register a user
        
      
        

          
          
            #
        
      
        

          
          
            # Pass a block for behavior when a user fails to save
        
      
        

          1
          
            def register_automatically(user, &block)
        
      
        

          
          
              # Automatic activation
        
      
        

          
          
              user.activate
        
      
        

          
          
              user.last_login_on = Time.now
        
      
        

          
          
              if user.save
        
      
        

          
          
                self.logged_user = user
        
      
        

          
          
                flash[:notice] = l(:notice_account_activated)
        
      
        

          
          
                redirect_to :controller => 'my', :action => 'account'
        
      
        

          
          
              else
        
      
        

          
          
                yield if block_given?
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          
          
            # Manual activation by the administrator
        
      
        

          
          
            #
        
      
        

          
          
            # Pass a block for behavior when a user fails to save
        
      
        

          1
          
            def register_manually_by_administrator(user, &block)
        
      
        

          
          
              if user.save
        
      
        

          
          
                # Sends an email to the administrators
        
      
        

          
          
                Mailer.account_activation_request(user).deliver
        
      
        

          
          
                account_pending
        
      
        

          
          
              else
        
      
        

          
          
                yield if block_given?
        
      
        

          
          
              end
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            def account_pending
        
      
        

          
          
              flash[:notice] = l(:notice_account_pending)
        
      
        

          
          
              redirect_to :action => 'login'
        
      
        

          
          
            end
        
      
        

          
          
          end
        
      
    
  

    

      
        

          
          
          # Redmine - project management software
        
      
        

          
          
          # Copyright (C) 2006-2012  Jean-Philippe Lang
        
      
        

          
          
          #
        
      
        

          
          
          # This program is free software; you can redistribute it and/or
        
      
        

          
          
          # modify it under the terms of the GNU General Public License
        
      
        

          
          
          # as published by the Free Software Foundation; either version 2
        
      
        

          
          
          # of the License, or (at your option) any later version.
        
      
        

          
          
          #
        
      
        

          
          
          # This program is distributed in the hope that it will be useful,
        
      
        

          
          
          # but WITHOUT ANY WARRANTY; without even the implied warranty of
        
      
        

          
          
          # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
        
      
        

          
          
          # GNU General Public License for more details.
        
      
        

          
          
          #
        
      
        

          
          
          # You should have received a copy of the GNU General Public License
        
      
        

          
          
          # along with this program; if not, write to the Free Software
        
      
        

          
          
          # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
        
      
        

          
          
          
        
      
        

          1
          
          class ActivitiesController < ApplicationController
        
      
        

          1
          
            menu_item :activity
        
      
        

          1
          
            before_filter :find_optional_project
        
      
        

          1
          
            accept_rss_auth :index
        
      
        

          
          
          
        
      
        

          1
          
            def index
        
      
        

          
          
              @days = Setting.activity_days_default.to_i
        
      
        

          
          
          
        
      
        

          
          
              if params[:from]
        
      
        

          
          
                begin; @date_to = params[:from].to_date + 1; rescue; end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
              @date_to ||= Date.today + 1
        
      
        

          
          
              @date_from = @date_to - @days
        
      
        

          
          
              @with_subprojects = params[:with_subprojects].nil? ? Setting.display_subprojects_issues? : (params[:with_subprojects] == '1')
        
      
        

          
          
              @author = (params[:user_id].blank? ? nil : User.active.find(params[:user_id]))
        
      
        

          
          
          
        
      
        

          
          
              @activity = Redmine::Activity::Fetcher.new(User.current, :project => @project,
        
      
        

          
          
                                                                       :with_subprojects => @with_subprojects,
        
      
        

          
          
                                                                       :author => @author)
        
      
        

          
          
              @activity.scope_select {|t| !params["show_#{t}"].nil?}
        
      
        

          
          
              @activity.scope = (@author.nil? ? :default : :all) if @activity.scope.empty?
        
      
        

          
          
          
        
      
        

          
          
              events = @activity.events(@date_from, @date_to)
        
      
        

          
          
          
        
      
        

          
          
              if events.empty? || stale?(:etag => [@activity.scope, @date_to, @date_from, @with_subprojects, @author, events.first, User.current, current_language])
        
      
        

          
          
                respond_to do |format|
        
      
        

          
          
                  format.html {
        
      
        

          
          
                    @events_by_day = events.group_by {|event| User.current.time_to_date(event.event_datetime)}
        
      
        

          
          
                    render :layout => false if request.xhr?
        
      
        

          
          
                  }
        
      
        

          
          
                  format.atom {
        
      
        

          
          
                    title = l(:label_activity)
        
      
        

          
          
                    if @author
        
      
        

          
          
                      title = @author.name
        
      
        

          
          
                    elsif @activity.scope.size == 1
        
      
        

          
          
                      title = l("label_#{@activity.scope.first.singularize}_plural")
        
      
        

          
          
                    end
        
      
        

          
          
                    render_feed(events, :title => "#{@project || Setting.app_title}: #{title}")
        
      
        

          
          
                  }
        
      
        

          
          
                end
        
      
        

          
          
              end
        
      
        

          
          
          
        
      
        

          
          
            rescue ActiveRecord::RecordNotFound
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          
        
      
        

          1
          
            private
        
      
        

          
          
          
        
      
        

          
          
            # TODO: refactor, duplicated in projects_controller
        
      
        

          1
          
            def find_optional_project
        
      
        

          
          
              return true unless params[:id]
        
      
        

          
          
              @project = Project.find(params[:id])
        
      
        

          
          
              authorize
        
      
        

          
          
            rescue ActiveRecord::RecordNotFound
        
      
        

          
          
              render_404
        
      
        

          
          
            end
        
      
        

          
          
          end